假wps vt1

mzltest

https://wormhole.app/eEDAz0#37Pj2FPEm-rfW5MKYGh68g

https://www.virustotal.com/gui/f ... 8d28b578aac/summary

last-modified: Sun, 15 Feb 2026 18:06:55 GMT
昨天凌晨两点的东西

来源
wps9[.]com -> 6x[.]org -> 目标
wps后面的数字也可以是1，应该是批量注册的wps#[.]com域名，需要有特定搜索引擎的来源才能打开。
6x那个是短链接，由wps#通过算法生成（sign=MD5(salt + "&" + timestamp + "&" + domain) 目前salt="and")，但目前不同的域名最后跳转到的是相同的链接。

WGC_ZY

ESSP：
Scan Log
Version of detection engine: 32704 (20260217)
Date: 2/17/2026  Time: 10:44:36 PM
Scanned disks, folders and files: C:\Users\Zhang\Downloads\wps\OIRUSJCJW_WPScoe_otrsc.exe
C:\Users\Zhang\Downloads\wps\OIRUSJCJW_WPScoe_otrsc.exe » NSIS » WPS.exe » NSIS » ___ - a variant of Win32/KingSoft_AGen.BJ potentially unwanted application - cleaned by deleting [1]
C:\Users\Zhang\Downloads\wps\OIRUSJCJW_WPScoe_otrsc.exe » NSIS » nw_elf.dll - a variant of Win32/Agent_AGen.GNN trojan - cleaned by deleting [1]
C:\Users\Zhang\Downloads\wps\OIRUSJCJW_WPScoe_otrsc.exe » NSIS » nw_elf.dll - a variant of Win32/Agent.AIHB trojan - cleaned by deleting [1]

Number of scanned objects: 43
Number of detections: 3
Number of cleaned objects: 3
Time of completion: 10:45:52 PM  Total scanning time: 76 sec (00:01:16)

Notes:
[1] Object has been deleted as it only contained the virus body.（虽然有一个是PUA，不过也扫出恶意dll了）

卡巴扫描也kill：

心醉咖啡

360扫描miss

Loyisa

AVG kill

xjwtzq

安天杀衍生物，奇安信扫描杀

猥琐大叔

成顔

组合技就是卡巴率先回滚的文件后面会被BD抢夺，我看看能不能优化下

c199529

腾讯电脑管家18
ver:20260218

---------------------
2026-2-18 21:32:50 MD5:21edf4a55b56678926cb82b281fb798b
wps\OIRUSJCJW_WPScoe_otrsc.exe [Win32.Trojan.FalseSign.Fmnw]
---------------------